Key Notes
- A public Reddit warning appeared in August 2025, and Joe Grand says Ledger had already encountered similar implants when he contacted the company.
- Zero Day dates his disclosure meeting to March 4, seven months before the October theft investigation became public.
- Earlier specimens and later retailer reports do not establish a single attacker or prove that every reported theft used the same implant design.
Ledger knew about hardware implants in its wallets months before the October cryptocurrency theft investigation became public, according to hardware researcher Joe Grand’s recorded account. His research describes an attack that captures recovery words on their way to the screen, without breaking the wallet’s secure element.
The warning trail begins with a Reddit post in August 2025 and reaches a disclosure meeting with Ledger on March 4, 2026. That meeting date comes from Kim Zetter’s reporting for Zero Day. Grand’s own conference presentation confirms that Ledger had already encountered similar implants when he contacted the company.
Joe Grand publishes his research into a Ledger Nano X hardware implant.
The record establishes prior awareness of the attack method. It does not establish that Ledger knew which later customers or retail inventories would be affected, or that every reported October theft resulted from the same implant design.
How a replacement battery exposed the attack
On August 17, 2025, a Thailand-based Reddit user posted photographs of a suspicious Nano X bought through Lazada. The buyer wanted a cheap replacement battery for an existing wallet and opened the purchase rather than using it to store cryptocurrency.
Inside were extra circuitry and wires. Grand later explained that a smaller battery made room for an added board and antenna. The accidental discovery became the starting point for his reverse engineering of a genuine wallet modified with malicious hardware.
The Reddit thread carries an official Ledger customer-response label. A Ledger support account asked the poster to open a support ticket and share its number so the case could be investigated. That response documents contact over the report, rather than a completed technical assessment at that stage.
March disclosure, followed by public research
March 4, 2026: Zetter reports that Grand notified Ledger and held a Zoom call with its team. She also reports subsequent email exchanges and technical discussions. Grand told Zero Day that he later sought an update and was told Ledger had not found evidence of theft using the implants.
In the conference recording, Grand says the company had experience with some of the devices already. He describes collaboration and information sharing with Ledger, as well as work toward additional hardware protections. His account places company awareness well before the October incident.
April 23, 2026: Grand announced that his presentation slides were online following his Tropicon appearance. The linked X post is dated April 23 in UTC, rather than April 24 as some recirculated timelines state.
May 2026: Grand presented the research at hardwear.io USA. His research page lists slides revised on May 29 and links the event recording, which hardwear.io uploaded to YouTube on June 30.
During the talk, Grand says three additional wallets he initially bought from unauthorized sellers all contained implants. He also says later purchases included unmodified units. These were targeted research purchases from suspicious listings, not a representative sample of all Nano X devices or Ledger’s authorized distribution network.
The implant steals words from the display path
The attack bypasses the need to extract a secret directly from the secure element. During setup, the wallet must display its recovery phrase so the owner can record it. Grand’s implant monitors the SPI connection carrying that display data to the OLED screen.
Its microcontroller recognizes letter patterns, reconstructs the recovery words and saves them. A separate LTE modem, eSIM and antenna provide a cellular route to transmit the phrase. The implant therefore does not depend on the owner deliberately uploading a backup or providing the wallet with a computer-based internet connection.
Possession of a recovery phrase can let an attacker recreate the corresponding wallet on other hardware. A device can continue appearing functional while the owner has unknowingly lost exclusive control of its accounts.
Ledger’s own Genuine Check documentation now makes the limit explicit: the check authenticates the secure element, but cannot detect spying implants or other unauthorized physical modifications when that original component remains intact. A genuine chip and an untouched device are different assurances.
September specimens were harder to recognize
Tibane Labs says it obtained two modified Nano X devices through Japanese marketplaces in September. Its field report, labeled October 2026, compares them with Grand’s earlier specimen and traces increasingly concealed designs.
The early version had conspicuous wires and a reduced battery. Later specimens used flexible circuits; the most concealed example had a black coating, fitted beneath the OLED and retained the original battery. Tibane interprets that design as suitable for repeatable installation, although it has not established the number of affected devices.
Our earlier Tibane coverage explains the technical findings and their limits. Neither of the lab’s specimens was bought from CryptoBilis, and its report does not establish a connection to that reseller. September acquisition dates should also be distinguished from the report’s later public release.
What October’s investigation has established
The October case brought the earlier research into a different setting: reported losses involving customers of an authorized reseller. Ledger’s October 10 company confirmation concerned an unauthorized implant found in one affected user’s device. It did not publish that unit’s model or a forensic comparison with Grand’s specimens.
In its October 11 update, Ledger said all confirmed cases associated with the disclosed October 9 draining incident involved CryptoBilis devices. It described the affected volume as limited without giving a count, and said its systems and direct sales channels remained unaffected.
Separate accounts have since widened the questions investigators face. CoinScreamer covered a buyer’s MediaMarkt report and Mark Karpelès’s examination of a Singapore Airport purchase. Those reports require their own provenance and forensic checks; they do not establish that every device in a named retailer’s inventory is compromised.
Our initial theft report discussed analyst Specter’s preliminary estimate above $86 million. That estimate should remain separate from a verified accounting of losses attributable to specific implanted devices.
The unresolved questions, and the current precautions
The timeline leaves a substantive question about how warnings, research collaboration and distribution safeguards developed between March and October. Awareness of a method does not by itself establish knowledge of a later campaign. Publicly available records also do not identify where every modification occurred, who installed it or how each affected device reached its buyer.
Ledger’s current CryptoBilis guidance is specific: do not initialize unused devices bought from that reseller; if already set up, move to a new seed on a device obtained from Ledger. The company has also instructed authorized distributors to use approved sourcing channels and never restock returned products.
A new device alone does not invalidate an exposed recovery phrase. Restoring that phrase recreates the same wallet. A replacement phrase generated on trusted hardware creates different keys, and assets must be transferred to their corresponding accounts. Recovery words should never be disclosed to support staff or submitted to an investigation website.
The earlier warnings are documented. The remaining task for investigators is to connect particular hardware, distribution records and theft transactions, while explaining which protections changed after the threat was first reported.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
